@sailresearch/code 0.1.0

package/src/credentials.js

@@ -0,0 +1,283 @@
+/**
+ * The `~/.sail` credential store, byte-compatible with the Sail CLI.
+ *
+ * The secret API key lives in `~/.sail/auth.toml` (0600); non-secret settings
+ * (mode, endpoint overrides, and the URL the key was validated against) live
+ * in `~/.sail/config.toml`. Environment variables always win over both files.
+ * The stored key is tagged with the URL it was validated against
+ * (`api_key_api_url`) and is applied only when the active target matches, so
+ * a key minted for one environment is never sent to another (fail closed).
+ */
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { MODE_API_URLS, MODE_VALUES } from "./constants.js";
+import { parseTomlTable, tomlBasicString } from "./toml.js";
+
+/** Settings keys recognized in config.toml, matching the Sail CLI. */
+export const SETTINGS_KEYS = [
+  "mode",
+  "api_url",
+  "sailbox_api_url",
+  "imagebuilder_url",
+];
+export const API_KEY_TARGET_KEY = "api_key_api_url";
+
+const AUTH_HEADER =
+  "# Managed by `sail auth`. The SAIL_API_KEY env var overrides this.\n";
+const CONFIG_HEADER =
+  "# Managed by `sail config` and `sail auth`. Env vars override these values.\n";
+
+export function sailHome() {
+  const raw = process.env.SAIL_HOME?.trim();
+  if (raw) {
+    if (raw.startsWith("~/")) return path.join(os.homedir(), raw.slice(2));
+    return raw;
+  }
+  return path.join(os.homedir(), ".sail");
+}
+
+export function authPath() {
+  return path.join(sailHome(), "auth.toml");
+}
+
+export function configPath() {
+  return path.join(sailHome(), "config.toml");
+}
+
+/** The stored API key, or null when auth.toml is absent or has no key. */
+export function loadAuthKey() {
+  const table = readTomlFile(authPath());
+  if (table === null) return null;
+  const key = typeof table.api_key === "string" ? table.api_key.trim() : "";
+  return key === "" ? null : key;
+}
+
+/** Recognized settings from config.toml; {} when the file is absent. */
+export function loadSettings() {
+  const table = readTomlFile(configPath());
+  if (table === null) return {};
+  const values = {};
+  const unknown = [];
+  for (const [key, value] of Object.entries(table)) {
+    if (SETTINGS_KEYS.includes(key) || key === API_KEY_TARGET_KEY) {
+      values[key] = String(value);
+    } else {
+      unknown.push(key);
+    }
+  }
+  if (unknown.length > 0) {
+    throw new Error(
+      `${configPath()} contains unrecognized setting(s): ${unknown.sort().join(", ")}. ` +
+        `Allowed settings: ${SETTINGS_KEYS.join(", ")}.`,
+    );
+  }
+  return values;
+}
+
+/** Settings, tolerating a missing or malformed file (login write path). */
+export function loadSettingsBestEffort() {
+  try {
+    return loadSettings();
+  } catch {
+    return {};
+  }
+}
+
+function readTomlFile(filePath) {
+  let text;
+  try {
+    text = fs.readFileSync(filePath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw new Error(`could not read ${filePath}: ${err.message}`);
+  }
+  return parseTomlTable(text, filePath);
+}
+
+/**
+ * The active public API URL and where it came from, mirroring the Rust CLI's
+ * resolution: the explicit `--mode` flag wins outright; otherwise each
+ * setting resolves env-else-stored (a *present but empty* env var masks the
+ * stored value, matching Rust `pick_setting`), and then a non-empty api_url
+ * always beats a mode (matching `resolve_target_api_url`). Defaults to prod.
+ *
+ * A malformed config.toml fails loudly here — same posture as the Rust CLI —
+ * so a typo'd file can't silently retarget requests or force a re-login.
+ */
+export function resolveTarget({ modeFlag } = {}) {
+  if (modeFlag) {
+    const url = MODE_API_URLS[modeFlag];
+    if (!url) {
+      throw new Error(
+        `unknown --mode "${modeFlag}" (expected one of: ${MODE_VALUES.join(", ")})`,
+      );
+    }
+    return { apiUrl: url, mode: modeFlag, source: "--mode" };
+  }
+  const settings = loadSettings();
+  const pick = (envName, storedKey) =>
+    process.env[envName] !== undefined
+      ? { value: process.env[envName].trim(), source: envName }
+      : { value: (settings[storedKey] ?? "").trim(), source: "config.toml" };
+
+  const apiUrl = pick("SAIL_API_URL", "api_url");
+  if (apiUrl.value) {
+    return {
+      apiUrl: apiUrl.value.replace(/\/+$/, ""),
+      mode: null,
+      source: apiUrl.source,
+    };
+  }
+  const mode = pick("SAIL_MODE", "mode");
+  const modeName = mode.value.toLowerCase();
+  if (modeName) {
+    if (!MODE_API_URLS[modeName]) {
+      // Fail closed, matching the Sail CLI: a typo like SAIL_MODE=production
+      // must never silently retarget to prod (and reuse a prod key).
+      throw new Error(
+        `unknown mode "${mode.value}" from ${mode.source} ` +
+          `(expected one of: ${MODE_VALUES.join(", ")})`,
+      );
+    }
+    return {
+      apiUrl: MODE_API_URLS[modeName],
+      mode: modeName,
+      source: mode.source,
+    };
+  }
+  return { apiUrl: MODE_API_URLS.prod, mode: "prod", source: "default" };
+}
+
+/**
+ * Whether the stored key's tagged target equals `effectiveTarget`, so the key
+ * is safe to apply. The target is the explicit `api_key_api_url` tag, or, if
+ * untagged, the one the stored `api_url`/`mode` imply. A key with no tag and
+ * no stored target hint never matches (fail closed).
+ */
+export function storedKeyMatchesTarget(settings, effectiveTarget) {
+  const stored = storedKeyTarget(settings);
+  if (stored === null) return false;
+  const effective = String(effectiveTarget ?? "")
+    .trim()
+    .replace(/\/+$/, "");
+  return effective !== "" && stored === effective;
+}
+
+function storedKeyTarget(settings) {
+  const nonempty = (key) => {
+    const v = settings[key]?.trim();
+    return v ? v : null;
+  };
+  const tag = nonempty(API_KEY_TARGET_KEY);
+  if (tag) return tag.replace(/\/+$/, "");
+  const apiUrl = nonempty("api_url");
+  const mode = nonempty("mode");
+  if (apiUrl === null && mode === null) return null;
+  if (apiUrl) return apiUrl.replace(/\/+$/, "");
+  const modeUrl = MODE_API_URLS[mode.toLowerCase()];
+  return modeUrl ? modeUrl.replace(/\/+$/, "") : null;
+}
+
+/** Write the API key to auth.toml atomically with 0600 permissions. */
+export function saveAuthKey(apiKey) {
+  ensurePrivateDir(sailHome());
+  const body = `${AUTH_HEADER}api_key = ${tomlBasicString(apiKey)}\n`;
+  atomicWrite(authPath(), body);
+  return authPath();
+}
+
+/**
+ * Persist the login target: tag the key with the URL it was validated
+ * against, and pin either the named mode or the explicit api_url (never
+ * both, so they cannot split the target). Other settings are preserved.
+ */
+export function saveLoginSettings({ target, mode }) {
+  const settings = loadSettingsBestEffort();
+  const cleanTarget = String(target).trim().replace(/\/+$/, "");
+  settings[API_KEY_TARGET_KEY] = cleanTarget;
+  if (mode && MODE_VALUES.includes(mode)) {
+    settings.mode = mode;
+    delete settings.api_url;
+  } else {
+    settings.api_url = cleanTarget;
+    delete settings.mode;
+  }
+  // Clear sibling endpoint overrides left from a previous target so a stale
+  // sailbox/imagebuilder host can't combine with the new central target
+  // (mirrors sail-cli authcmd.rs validate_and_store).
+  delete settings.sailbox_api_url;
+  delete settings.imagebuilder_url;
+  ensurePrivateDir(sailHome());
+  let body = CONFIG_HEADER;
+  for (const key of Object.keys(settings).sort()) {
+    body += `${key} = ${tomlBasicString(settings[key])}\n`;
+  }
+  atomicWrite(configPath(), body);
+  return configPath();
+}
+
+/** Mask a secret for display: `abcd…wxyz`, or `***` when too short. */
+export function maskSecret(secret) {
+  const s = String(secret ?? "");
+  if (s === "") return "";
+  const chars = [...s];
+  if (chars.length <= 8) return "***";
+  return `${chars.slice(0, 4).join("")}…${chars.slice(-4).join("")}`;
+}
+
+function ensurePrivateDir(dir) {
+  if (fs.existsSync(dir)) return;
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+}
+
+/**
+ * Atomic write (temp file + rename). New files get 0600 (everything written
+ * here may hold a secret); pass `preserveMode: true` to keep an existing
+ * destination's permissions instead of silently tightening them, and add
+ * `tighten: true` when the CONTENT holds a secret — owner bits are preserved
+ * but group/other access is masked off (0644 → 0600).
+ */
+export function atomicWrite(
+  filePath,
+  contents,
+  { preserveMode = false, tighten = false } = {},
+) {
+  let mode = 0o600;
+  if (preserveMode) {
+    try {
+      mode = fs.statSync(filePath).mode & 0o777;
+    } catch {
+      // Destination doesn't exist yet: keep the private default.
+    }
+  }
+  if (tighten) mode &= 0o700;
+  const dir = path.dirname(filePath);
+  const tmp = path.join(dir, `.${path.basename(filePath)}.${process.pid}.tmp`);
+  try {
+    fs.writeFileSync(tmp, contents, { mode });
+  } catch (err) {
+    // writeFileSync opens (creating tmp) then writes, so a failure mid-write
+    // (ENOSPC/EDQUOT) leaves a partial temp file — which can hold the secret
+    // `contents` and, for project setup, isn't covered by `.claude/.gitignore`
+    // (only the final filename is). Remove it before propagating.
+    try {
+      fs.unlinkSync(tmp);
+    } catch {
+      // Never created, or already gone — nothing to clean up.
+    }
+    throw new Error(`could not write ${filePath}: ${err.message}`);
+  }
+  try {
+    fs.renameSync(tmp, filePath);
+  } catch (err) {
+    try {
+      fs.unlinkSync(tmp);
+    } catch {
+      // Best effort: the rename error is the one worth surfacing.
+    }
+    throw new Error(`could not replace ${filePath}: ${err.message}`);
+  }
+}